Body area network pairing improvements for clinical workflows

ABSTRACT

A method for establishing a connection between a first electronic computing device and a second electronic computing device includes moving the second electronic computing device so that it is proximal to the first electronic computing device. When the first electronic computing device detects the proximity of the first electronic computing device relative to the second electronic computing device, a radio on the first electronic device is set to a connectable and discoverable state. A wireless connection is automatically established between the first electronic computing device and the second electronic computing device. Data is transmitted between the first electronic computing device and the second electronic computing device.

CROSS REFERENCE TO RELATED APPLICATION

This application is related to U.S. patent application Ser. No.12/723,726, titled “Personal Area Network Pairing” and filed Mar. 15,2010, the contents of which are incorporated herein by reference.

BACKGROUND

Personal area networks in a medical setting permit sensor data from apatient to be efficiently transmitted to a display device. Thesenetworks typically use Bluetooth technology both in sensors attached tothe patient and in the display device. Each Bluetooth sensor istypically paired to the display device to enable the transmission ofsensor data to the display device.

In order for a Bluetooth sensor to be paired to a display device, powermust be applied to both the Bluetooth sensor, including the sensorradio, and the display device including, the display device radio. Eachradio must be in a connectable mode. Further, if the radios in thesensor and display device are not aware of each other, the radios mustalso be in a discoverable state. Typically, Bluetooth sensors operate onbattery power. It is desirable that a mechanism for applying power to aBluetooth sensor be easy to use, minimize drainage of the battery,connect to the desired display device and ensure that the patient becorrectly identified.

SUMMARY

Aspects of the disclosure are directed to establishing a connectionbetween a first electronic computing device and a second electroniccomputing device. The second electronic computing device is moved sothat the second electronic computing device is proximal to the firstelectronic computing device. The first electronic computing devicedetects the proximity of the first electronic computing device relativeto the second electronic computing device. When the first electroniccomputing device detects the proximity of the first electronic devicerelative to the second electronic computing device, a radio on the firstelectronic computing device is set to a connectable and discoverablestate. A wireless connection is established between the first electroniccomputing device and the second electronic computing device. Data istransmitted between the first electronic computing device and the secondelectronic computing device.

In another aspect, a medical sensor device includes a system memory, aprocessing unit, a physiological sensor, a radio device, a housing, aprinted circuit board, a proximity detector and a power source. Thephysiological sensor is attached to a patient in a medical facility. Thephysiological sensor monitors one or more types of physiological datafrom the patient. The radio device establishes a wireless connection toa patient monitoring device. The physiological data from the patient istransmitted from the medical sensor device to the patient monitoringdevice via the wireless connection. The power source is configured toswitchably provide power to the medical sensor device. The actuation ofthe proximity detector causes the radio device to be placed in aconnectable state.

In another aspect, a patient monitoring device includes a system memory,a processing unit, a display unit, a radio device, a network interfaceto a server computer, a housing, a printed circuit board and a proximitydetector. The display unit displays medical data from one or morepatients in a medical facility. The radio device is capable ofestablishing a wireless connection to a physiological sensor device fora patient in the medical facility. The radio device receivesphysiological data from the patient via the wireless connection. Thephysiological data from the patient is transmitted to the servercomputer via the network interface. The radio device establishes thewireless connection to the physiological sensor device after theproximity detector actuates at a predetermined threshold.

The details of one or more techniques are set forth in the accompanyingdrawings and the description below. Other features, objects, andadvantages of these techniques will be apparent from the description,drawings, and claims.

DESCRIPTION OF THE DRAWINGS

FIG. 1 shows an example personal area network for a medical application.

FIG. 2 shows example modules of a physiological sensor and of thepatient monitor of FIG. 1.

FIG. 3 shows an example patient monitor that includes a proximitydetector.

FIG. 4 shows example components of the proximity detector of FIG. 3.

FIGS. 5 and 6 show a flowchart for a method of establishing a connectionbetween a sensor device and a gateway device in the personal areanetwork of FIG. 2.

DETAILED DESCRIPTION

The present disclosure is directed to example systems and methods forpairing physiological sensor devices for a patient in a personal areanetwork. In the systems and methods, a proximity detector is used toenable devices to execute functions such as turning on power at a sensordevice, turning on power to a radio in the sensor device, and enablingthe radio device to making a radio connection between devices. Theproximity detector turns the power on at the sensor device when thesensor device is in close proximity to a gateway device. The gatewaydevice is typically a monitoring and display device that also providesaccess to a local or wide area network for transmitting sensor data to aserver computer. The gateway device also includes a proximity detector.Typically, the gateway device includes a source of AC power so that thegateway device is generally powered on. However, in other examples, thegateway device may be battery operated and may not be powered on untilthe gateway device comes into proximity with a sensor device.

In example embodiments, the proximity detector on the sensor deviceprovides a magnetic mechanism to activate power at the sensor device.Each proximity detector includes both a magnet and a magnetic detector.When the proximity detector on the sensor device is in close proximitywith the proximity detector on the gateway device, the magnetic detectoron the gateway device detects the magnet on the sensor device and themagnetic detector on the sensor device detects the magnet on the gatewaydevice.

The detection of the magnet by the sensor device activates power on thesensor device and the detection of the magnet on the gateway deviceprovides an indication to the gateway device that power is activated onthe sensor device. In examples where the gateway device does not includeAC power or in cases where the gateway device does include AC power butis powered off, the detection of the magnet on the gateway deviceactivates power on the gateway device. Once power is activated on boththe sensor device and the gateway device, a Bluetooth pairing sequenceis initiated and the sensor device is paired to the gateway device.

If either the sensor device or the gateway device is already powered,then the proximity detection may power the radio, enable the radio andput the radio in a connectable state. If the radio in either the sensordevice or the gateway device is already powered, then the proximitydetection may put the radio in a connectable state.

Other proximity detectors may be used. If each device has a coil,magnetic coupling allows the coil in one device to detect if the coil inthe other device has a current. One could pulse current in the firstcoil and detect the current pulse in the second coil. Detection of thecurrent pulse in the coil of the first device by the coil of the seconddevice would indicate proximity. A related solution with a magnet and acoil in the first device and a magnetic detector and a coil on thesecond device could have the second device detect proximity of the firstdevice through actuation of the magnetic switch. The proximity detectioncauses the second device to enable its radio and also to pulse a currentthrough its coil. This current pulse is detected in the first device,causing it to enable its radio. Alternately, placing a load on thereceiving coil allows the transmitting coil to detect proximity of thereceiving coil as reflected impedance of the receiving coil's loadaffects the current and voltage in the transmitting coil. Proximitydetection may be accomplished through time stamps of related signals,such as acceleration when two devices are tapped together. A time stampon the signals can be used as a filter to ensure that the two deviceswere tapped at close to the same time. Alternately, a device may requirea specific sequence such as three taps before enabling the radio.Optical signals (IR, UV, or Visible) from one device may be received bythe second and these could be both detected by the second device and bereflected back to the first device. By encoding the optical signal, onemay confidently assume the signal is authentic. A resistive detectioncould be used to detect if one device touches another as could one-wireserial where making electrical contact causes one device to transmitdata to the other, such as a Bluetooth address and other out of bandcommunication. Capacitive touch switches may be placed on a printedcircuit board or embedded in the plastic cases creating a hidden switchthat is activated when a hand is brought nearby. Ultrasonictransceivers, Ultra-Wideband (UWB) and RFID may be used for bothproximity detection and communication of out of band data. For example,UWB can be used to determine if the range between two radios is lessthan 25 cm and only then allow the radios to connect.

The systems and methods of the present disclosure may also usecontextual data to determine when to change the radio state toconnectable or connectable and discoverable. For example, a sensor mayassume that it is in range of a gateway whenever the sensor is powered,whenever a new measurement is requested or when other contextual eventsoccur and automatically put its radio in a discoverable and connectablestate. Other contextual events include one or more of: losing connectionto a previous gateway, detecting a new gateway, detecting a decrease inreceived power from the current gateway, detecting an increase inreceived power from a new gateway and receiving new patient information.

A personal area network is a computer network used for communicationbetween computer devices close to an individual person. A personal areanetwork may also be referred to as a body area network when the personalarea network is a collection of physiological sensors and monitors. Inthis disclosure, pairing refers to Bluetooth pairing and also toequivalent transmission of credentials and information, such as anaddress, required to establish a radio connection. These credentials mayinclude authentication credentials, such as public keys and nonces thatmay be used to authenticate devices for secure, authenticated datatransfer.

In a medical setting, a personal area network may include physiologicalsensor devices attached to a patient that are used to monitor healthparameters of the patient. Some examples of physiological sensor devicesused in a medical setting are blood pressure monitoring devices,thermometers, ECG sensors, EEG sensors, cardiac output sensors, ETCO₂sensors, and oxygen saturation sensors (SPO₂). Other types of sensordevices can be used. The sensor devices typically transmit sensor dataover a network to a patient monitoring device, such as a wall-mounteddisplay unit or a central station, such as the ACUITY® CentralMonitoring System from Welch Allyn Inc. of Skaneateles Falls, N.Y. Apersonal area network may also include a Personal Digital Assistant(PDA), perhaps used by a clinician to interact with the patients'personal area networks such as the Clinician Notifier product from WelchAllyn Inc. of Skaneateles Falls, N.Y. The PDA could join a patientnetwork either using a menu-based system as is common for Bluetoothconnections today or it could have a proximity detector that causes thePDA to joint the personal area network.

One type of radio device used in a wireless personal area network is aBluetooth radio. Bluetooth is a wireless technology that can be used inpersonal area networks to transmit and receive data over short distances(generally less than 30 feet, although data can be transmitted up 100meters depending on device class). Bluetooth uses a layered protocolarchitecture consisting of four core layers and associated protocols.The physical layer is the lowest layer in each Bluetooth device and isinstantiated as a radio frequency (“RF”) layer that includes atransceiver with transmit and receive capability. Bluetooth uses themicrowave radio spectrum in the 2.402 GHz to 2.4835 GHz range.

Bluetooth devices are peer devices, each including a Bluetooth radio andthe four core protocol layers. However, when two or more Bluetoothdevices are connected in a personal area network, one device can becomea master device and the remaining devices then become slave devices. Amaster Bluetooth device can communicate with up to seven slave devices.However, a slave can switch roles and become a master at any given time.A Bluetooth device may be a slave in one personal area network and amaster in a second personal area network. Later version of the Bluetoothspecification, such as Bluetooth LE, provide for a larger set of peerdevices.

Because Bluetooth is a wireless technology, the integrity and privacy ofthe transmitted data are a concern. To improve the integrity and privacyof data transmission, Bluetooth permits two devices to be paired witheach other where the devices transmit on an encrypted link so that theycan securely communicate with each other. Once two devices are paired,they can connect and communicate with each other without additional userintervention. The pairing process is typically initiated the first timea device receives a connection request from a device to which it is notalready paired. During the discovery process Bluetooth addresses of eachdevice are shared and during the pairing process, a shared secret key,known as a link key, is generated by the two devices. This link key isused to generate an encryption key, which is used to encrypt data forthe current session. If the link key is stored along with the Bluetoothaddress of the peer device, then the devices are bonded so that thepairing information can be used in the future, even if the device(s) hasbeen power cycled or if the devices have been out of range of eachother. If either device deletes the link key, pairing must occur againbefore communication can occur. At the start of each communicationsession, the link key is used in a process to cryptographicallyauthenticate the identity of the device, and be sure that it is the samedevice with which it previously paired.

In a wireless personal area network, sensor data is transmitted using awireless data exchange protocol, such as Bluetooth, to a central point,called a hub. Often, this central point has a connection to a largernetwork, such as an 802.3 or 802.11 LAN. A hub with a connection to adifferent type of network is called a bridge.

In a wireless personal area network for monitoring sensor data, eachsensor device may be joined to the network. In Bluetooth, joining anetwork when none of the network information is known requires discoveryto learn the Bluetooth address of the other device, connection toinitiate communication, and pairing to generate a shared secret key forauthentication and encryption. While this disclosure uses Bluetooth asan example personal area network, any network, including 802.15.4,Bluetooth LE, ZigBee, UWB, a low-power 802.11 network, Wi-Fi™ Direct, ora proprietary network could be used. Other physical media such as IR asdisclosed in the IEEE 802.11-1999 standard and ultrasonic may be used inlieu of RF. Of these, some technologies allow for ranging and rangingallows proximity detection. These include at least UWB, IR, andUltrasound.

A hub to which multiple sensors are paired that includes a display toshow the physiological state of the patient is a patient monitoringdevice. This type of hub typically has a local area network uplink,making the patient monitoring device a bridge. Any RF enabled devicewith a processor and display, including a PDA, cellular phone, PC, orlaptop can operate as a hub and also as a patient monitor. Theappropriate pairing of a sensor device with a patient monitoring deviceensures that the sensor data is properly transmitted to the correctmonitoring device. This is particularly important in a medical settingthat may include a plurality of patients, sensors, monitoring devicesand personal area networks to ensure that a particular patient'sphysiological data is tagged with his patient identifier. The patientidentifier may be encrypted independent of any encryption that occursautomatically on the communication link to further ensure protection ofelectronic personal health information.

The procedure for pairing a sensor device to a monitoring devicetypically requires a user to manually enter data to authenticate thatthe proper devices are connecting in order to complete the pairing. Forexample, using Bluetooth 2.0, the two devices that pair require that thesame PIN is presented to both devices. For some limited functionalitydevices, such as headsets, the PIN for the headset may be hard codedinto the headset and the user enters the PIN into the device to bepaired, e.g., a cellular telephone. Since no data are transacted priorto PIN entry and the PIN is not transmitted, this process verifies thatthe user intends the two devices to establish a connection. Thissolution works reasonably well if the device is only to be paired once.The PIN solution also has security and usability issues, particularly asimplemented. For example, the PIN for most headsets is an easy toremember number such as 0000 or 9999, so an intruder can guess the PINand masquerade as the intended device. In addition, a brute force attackrequires only 10,000 different sequences (Although Bluetooth 2.0 uses a16-byte PIN, this is usually generated by augmenting a 4-digit PIN withpart of the Bluetooth address of the device, which is known). If the usecase requires pairings to be made, removed, and re-built as occurs inclinical applications, the time to enter the PIN and navigate menus maybe cumbersome. The systems and methods described in the presentdisclosure permit sensor devices to be attached to a patient and pairedto a monitoring device in an efficient and automated manner, therebyminimizing the need for a user to manually enter information.

An improved pairing mechanism introduced in Bluetooth Version 2.1+EDR isSecure Simple Pairing (SSP). SSP has four modes of operation: NumericComparison, Passkey Entry, Out-Of-Band (OOB), and Just Works. With thefirst two modes, some degree of user intervention is required to eitherenter or compare numeric values that are computed as a function of thelink key. In the third mode, an auxiliary set of transceivers must existto transmit the Bluetooth pairing information. In the fourth mode, thedevices assume that a user authentication step occurred and opens thedevice to a security risk, such as a man-in-the-middle (MITM) attack.This risk can be mitigated by only placing the devices in a pairing modewhen proximity is detected and also through application level filteringof the devices. For example, if the radios are neither connectable nordiscoverable, except for a few seconds while the pairing information isexchanged, it is extremely unlikely an eavesdropper could detect thePersonal Area Network (PAN) and generate a MITM attack before thepairing completes. If an incorrect device pairs, application levelsoftware can cause the radio to delete pairing information and destroythe RF connection. Such deletion and destruction can occur before anydata are accepted across the RF link. Application level software candetermine correct device pairings through several methods includingcomparing the Bluetooth address to a known list of acceptable addresses,through an application level challenge-response or other authenticationsolution.

FIG. 1 shows example physiological sensors that can be used on a patient100 in a personal area network for a medical application. The fourphysiological sensors include an example thermometer 104, ECG sensor106, blood pressure sensor 108 and SPO₂ sensor 110. The SPO₂ sensor isalso known as an oxygen saturation sensor. The sensors 104, 106, 108,and 110 can be paired to patient monitor 208 and communicate with amedical application over a personal area network, as described below.

FIG. 2 shows an example personal area network 200 for a medicalapplication. The example personal area network 200 includes the exampleSPO₂ sensor 110 and an example patient monitor 208. The example personalarea network 200 may also include one or more of the examplephysiological sensors 104, 106 and 108 (shown in FIG. 1). Each of theexample physiological sensors 104, 106, 108, 110 has Bluetoothcapability. The example SPO₂ sensor 110, as well as the example sensors104, 106 and 108, also includes a proximity detector 202, sensorelectronics 204 and a Bluetooth radio 206.

The example patient monitor 208 includes a proximity detector 210 andmay include one or more embedded sensors 212 that have a physicalattachment to patient monitor 208. The patient monitor also includes adisplay 214 that indicates the state of various sensors and networkconnections. In addition, the patient monitor 208 includes a Bluetoothradio 216 and a LAN/WAN connection 218, providing a gateway 217. TheLAN/WAN connection 218 permits data to be transmitted between theexample personal area network 200 and one or more server computers 220that are accessible via the LAN/WAN connection. Other networkconnections including mesh, UWB, MAN and the like may allow connectionto the one or more server computers 220.

Typically, the example physiological sensors 104, 106, 108, 110 are notpowered on until they are activated and placed on the patient. Theexample patient monitor 208 is may be continually powered on. Forexample, the patient monitor 208 may be a wall-mounted unit or may bepermanently mounted to a stand or other apparatus in hospital room. Whenthe patient monitor 208 is permanently mounted, the patient monitor 208typically is connected to AC power and is typically continually poweredon. Alternatively, the patient monitor 208 may be a portable unit thatis operated via battery power. When the patient monitor 208 is aportable unit, the patient monitor is typically powered on manually viaa power-on button. However, in examples, a portable patient monitor mayalso be power on automatically via the proximity detector 210.

In order for Bluetooth pairing to occur, Bluetooth devices must be bothdiscoverable and connectable. By using a proximity detector in aBluetooth device, for example physiological sensor 110, the Bluetoothdevice may be kept in a low power state to save power until theBluetooth device is moved into close proximity with a second Bluetoothdevice, for example patient monitor 208.

In some examples described herein, the physiological sensor 110 is off.In other examples, the physiological sensor 110 can be in a low powerstate including any of the following: the physiological sensor 110 beingcompletely off, the microprocessor of physiological sensor 110 operatingin a low power mode, the radio in physiological sensor 110 being in alow power mode, the radio in physiological sensor 110 being on, but notin a connectable state, or the radio in physiological sensor 110 beingoff. Regardless of the state of the physiological sensor 110 and itsradio, detection of another proximal device causes the physiologicalsensor 110 and its radio to move to a state where the radio can connectto another device.

When the physiological sensor 110 is moved proximally to the patientmonitor 208, power is turned on at the physiological sensor 110, poweris turned on at the patient monitor 208 if power is not already turnedon at the patient monitor 208, the radios on both the physiologicalsensor 110 and the patient monitor 208 are placed in connectable anddiscoverable mode, and Bluetooth pairing occurs between thephysiological sensor 110 and the patient monitor 208. The Bluetoothpairing establishes a wireless connection between the physiologicalsensor 110 and the patient monitor 208. Note that if sensor 110 andpatient monitor 208 have previously paired and bonded, the radios do notneed to discover each other. Similarly, if the sensor 110 and patientmonitor 208 have been provisioned with the pairing information, perhapsat manufacturing, the radios do not need to discover each other. Oncepaired to the patient monitor 208, the physiological sensor 110 isplaced on the patient 100 and physiological data is sent from thephysiological sensor 110 to the patient monitor 208 via the wirelessconnection. For a body-worn patient monitor 208, pairing may occur afterthe sensor is placed on the patient 102 and pairing may occur after thepatient monitor 208 is placed on the patient 102.

Providing an auxiliary, low power discovery permits the medical deviceto be selective in the devices with which it might connect. For example,upon detection of an auxiliary discovery signal, the radio may changestate to “discoverable” or “discoverable and connectable” for a limitedtime so that only the opportunity to connect to the wrong device isdecreased compared to a device that is always in the “discoverable” or“discoverable and connectable” state. If both sides of the connectionhave this feature, then the opportunity to connect to the wrong deviceis further diminished. When one device is AC powered, the radio may bekept in connectable and discoverable mode all the time and rely on thephysiological sensor 110 to correctly initiate pairing. However, if thedevice is always in a connectable and discoverable state, theopportunity is open for either the wrong device or a malevolent deviceto connect. Alternately, the AC powered device may exit discoverablemode, but stay in connectable mode. This allows another sensor, perhapsthat has lost contact with its primary gateway, to send physiologicaldata via an alternate gateway. Even if this other sensor does not have apatient ID, a unique identifier such as the sensor serial number can beassociated to the patient. With this unique identifier, sensor datatransmitted via an alternate gateway can be associated with the correctpatient ID at the server computer 220. Another case for keeping radiosin connectable mode allows re-connections to occur. Once a physiologicalsensor is communicating with a patient monitor, each will likely keepits radio in connectable mode, but not discoverable mode. This allowsthe two devices to re-connect if the RF link is broken, but does notallow any other devices to discover the PAN. To keep the network moresecure but still allow devices to reconnect, the devices may also exitboth discoverable and connectable states after connecting to sensors andupon loss of RF connection move to the connectable state.

As devices connect to different gateways, the status of those devices,including location, need for periodic maintenance, battery status,software revision and the like may be annotated to a server for use bythe biomedical engineers and clinicians. After Bluetooth pairing iscompleted, status and configuration information are transferred betweensensor device and gateway device, for example between physiologicalsensor 110 and patient monitor 208, to verify that both the sensordevice and the gateway device are operational and compatible with eachother. For example, application software of patient monitor 208 mayquery physiological sensor 110 to verify that physiological sensor 110has passed a diagnostics self test, to verify the strength of a batteryon physiological sensor 110, to determine if any component ofphysiological sensor 110 is in need of repair or due for periodicmaintenance, or to determine the status of the RF connection. Thisstatus information may be transmitted along with other parameters fromthe monitor such as its own RF connection strength to the IT network,battery status, and location. These data may be used to trendperformance, debug connection issues, or to determine if maintenance isrequired. In addition to the status information, the sensor providesmodel and version information. The model and version of the sensordevice are compared with the model and version of the gateway device todetermine whether the sensor device and gateway device are compatible.

When the sensor device and the gateway device are paired, the sensordevice and the gateway device are said to have a logical connection witheach other that is analogous to the connection that occurs when a cableis plugged into the monitor. This logical connection may occur at an RFlevel or at an application level. For example, the logical connectionmay occur at the RF level after the devices are paired or the logicalconnection may occur at the application level when the compatibilitycheck between devices is completed. In the cable analogy, plugging thecable into the device is analogous to the RF connection and the devicerecognizing the cable and the sensors at the end of that cable areanalogous to a connection at the application level.

After status and compatibility are checked and verified between sensorand gateway devices, a clinician is required to verify the sensor devicefor a specific patient. Requiring the clinician to confirm the sensordevice for a specific patient provides an additional level of securityto ensure that the sensor device is placed on the correct person. Inaddition, the clinician must confirm the sensor for a specific patientwithin a short time period after the sensor device and the gatewaydevice are placed in connectable and discoverable modes. Throughconfirming the device the clinician indicates to the system that thedata from the new sensor belongs to the same patient as is indicated onthe patient monitor. If the clinician does not confirm the sensor for aspecific patient within the short time period, the wireless connectionbetween the sensor device and the gateway device is broken and thelogical connection between the sensor device and the gateway device isdestroyed. The reset of the logical connection might include removal ofthe pairing information. By allowing pairing for only a short timeperiod after the sensor device and the gateway device are placed inconnectable and discoverable modes, MITM attacks are minimized. The timeperiod must last long enough for both radios to enter the connectablestate and connect or to enter the connectable and discoverable state, bediscovered, and connect. A short time period may be range from a hundredmilliseconds to several seconds. Preferably, the radio exits theconnectable state or the connectable and discoverable state immediatelyupon initiation of a radio connection. Leaving the logical connection inplace could allow the sensor to maintain a connection to the incorrectmonitor. The system may be configured to allow the unconfirmedconnection to remain; but without indicating the patient ID. In thiscase, a pseudo-ID may be used to identify the data until such time as apatient ID is assigned to the sensor. For example, the data might besaved in a database keyed by the sensor serial number instead of thepatient ID. If the sensor is later correctly connected to the properpatient monitor, the data that has been thus far collected and stored isannotated with the patient ID associated with the proper patientmonitor.

After the clinician confirms the sensor device for a specific patient,the clinician selects a connection mode for the connection between thesensor device and the gateway. The connection mode describes the extentto which alarms and equipment alerts are generated in the connection. Analarm refers to an error condition for a patient while an equipmentalert refers to an error condition for the medical equipment.Application software at the gateway device permits the clinician toassign one of three connection modes—loose pairing, tight pairing andlocked. Each connection mode is defined to match a specific workflow andprovides a class of alarm response. For example, loose pairing providesone class of alarm response, tight pairing provides a second class ofalarm response and locked provides a third class of alarm response.Other application-level connection modes and combinations thereof may beused to match different workflows.

Loose pairing is typically used for a spot monitoring workflow in whicha sensor device is periodically brought into a patient's room to check aphysiological parameter that is not being monitored by the patientmonitor in the patient's room. This is sometimes referred to as spotchecking. In a workflow that uses loose pairing, there are no equipmentalerts if the connection between the sensor device and the gatewaydevice is broken. There may also be no alarms as the workflow includes aclinician at the patient location.

Tight pairing is typically used for a workflow in which there iscontinuous monitoring of patient physiological data. In a tight pairingconnection, an equipment alert is generated whenever certain errorconditions occur. For example, an equipment alert is generated when thewireless connection between the sensor device and the gateway device isbroken. This is analogous to an equipment alert if an ECG cable isremoved from the monitor or the ECG electrode falls off the patient.Another error condition that causes an alarm to be generated is when thegateway device determines that one or more physiological parametersreceived from the sensor device is above or below a predeterminedthreshold. Other error conditions that cause an equipment alertcondition to be generated include: need for maintenance (includingscheduled periodic maintenance), sensor device loss of power,unacceptable RF performance such as high packet loss or poor signallevel, RF interference, inappropriately sized blood pressure cuffdetected, ECG lead failure, SPO₂ sensor with no signal detected, asensor that is not confirmed for a particular patient, and otherequipment alerts familiar to those skilled in the art.

When an error condition occurs in the tight pairing connection modewhere the connection from the patient to the device comes into question,in addition to an alarm being generated, the wireless connection betweenthe sensor device and the gateway device may be broken and pairinginformation for the connection may be deleted at the sensor device andat the gateway device. For example, if a physiological sensor falls ofthe patient, when the physiological sensor is re-attached, the clinicianmay be required again connect the Bluetooth radios. The deletion ofpairing information when the connection is broken prevents physiologicaldata from the sensor device from being associated with an erroneouspatient identification number. Alternately, the application levelsoftware may allow the Bluetooth connection to persist, but stopannotation of the data with the patient ID until the patient ID isconfirmed. A system may also stop the data flow from the sensor untilthe patient ID is confirmed. The system may have a record of the dataand use an algorithm such as pattern recognition to verify the sensor isstill attached to the same patient or the system may correlate thephysiological signal from the unconfirmed sensor with physiological datafrom a confirmed sensor to determine if they are still on the samepatient. If the data correlates, the system may begin annotating datafrom the previously unconfirmed sensor.

Locked pairing is used when it is determined that a sensor device isonly to be connected to a specific gateway device, for example to thepatient monitor 208 or to a select set of gateway devices. When a sensordevice is used with locked pairing, an equipment theft alert isgenerated when an attempt is made to connect the sensor device to agateway device that is not included in the select set of gatewaydevices. The intent of a locked connection is to minimize the potentialfor the sensor device from being moved, borrowed or stolen from thegateway device to which the sensor device is connected. To allow thelocked sensor device to be moved to a different gateway, as may be thecase when the original gateway is damaged or has a dead battery, a resetcapability is designed into the product. This may be through a hiddenservice screen, a reset button, through a specific set of key strokes orsimilar method that obscures the ability to remove the locked pairingconfiguration.

FIG. 3 show an example patient monitor 300. The example patient monitor300 is a portable device and includes two example proximity detectors308 and 310. The proximity detectors 308 and 310 are mounted internallyin the patient monitor 300 with one surface of each of proximitydetectors 308 and 310 being adjacent to an external surface of thepatient monitor 300.

Also shown in FIG. 3 are two example physiological sensor devices 304,306, each including a proximity detector, for example proximity detector202. Arrow 312 shows the direction in which physiological sensor device304 is moved to become in close proximity with proximity detector 308.Arrow 314 shows the direction in which physiological sensor device 306moves to become in close proximity with proximity detector 310. Inexamples, more or fewer proximity detectors may be used and theproximity detectors may be located on different areas of the patientmonitor 300.

FIG. 4 shows an example physical view for the proximity detectionmechanism for physiological sensor 110 and proximity detector 202.Physiological sensor 110 is housed in a plastic housing 402 and includesa printed circuit board (PCB) 404 that includes sensor electronics 204and Bluetooth radio 206 (not shown), a magnet 408 and a magneticdetector 406. The magnet 408 and magnetic detector 406 compriseproximity detector 202. Patient monitor 208 is housed in a plastichousing 410 and includes a printed circuit board 412, a magnet 416 and amagnetic detector 414. The magnet 416 and magnetic detector 414 compriseproximity detector 210. Patient monitor 208 includes the Bluetooth radio216 (not shown). When physiological sensor 110 is moved into closeproximity with patient monitor 208, magnet 408 on physiological sensor110 activates magnetic detector 414 in patient monitor 208 and magnet416 on patient monitor 208 activates proximity detector 406 onphysiological sensor 110.

The magnetic detectors 406, 414 are typically a magnetic switch such asa reed switch, a reed relay, a Hall Effect sensor, a Hall Effect switchor a giant magnetoresistance (GMR) detector. These magnetic switchespermit proximity detection using very low power.

The reed switch is a normally open switch, thereby drawing little or nopower in the open state. The reed switch closes when a magnetic field ofa predetermined threshold is detected by the reed switch. A typicalthreshold for a sensitive reed switch may vary between 5 Ampere-Turnsand 15 Ampere-Turns. However, this assumes a uniform magnetic fieldalong the axis of the axially leaded part.

A Hall effect sensor generates a voltage in response to a magneticfield. The generated voltage increases as the magnetic field increases.For example, when a magnet is moved in the proximity of the Hall effectsensor, the magnetic field of the magnet cutting through the sensorincreases as the magnet is moved closer to the Hall effect sensor. TheHall effect sensor may be combined with circuitry such as a comparatorthat permits the Hall effect sensor to act as a switch. When themagnetic field reaches a predetermined threshold, a magnetic switchcloses, signifying an “on” state. A sensitive Hall effect sensor mayoperate at field strengths of around 10 to 25 Gauss, depending ontemperature and frequency of the magnetic field.

A GMR switch includes giant magnetoresistance material and makes use ofthe concept of magnetoresistance. With magnetoresistance the electricalresistance of the GMR material changes its value when a magnetic fieldis applied to it. When the magnetic field reaches a predeterminedthreshold, the resistance of the GMR material is changed to a point suchthat sufficient current flows through a bridge in the GMR switch toclose the GMR switch, signifying an “on” state. Some GMR switches, forexample GMR switches in the AFL200 series from NVE Corporation, requireonly a few microamperes of supply current. A sensitive GMR switch mayoperate at a field strength of7-13 Gauss.

Whether the magnetic switch is normally open or normally closed is notrelevant to the detection of an applied magnetic field; rather only thestate change is important.

Magnetic flux densities decrease in strength exponentially withincreasing distance from the source of the magnetic field, for example amagnet. The magnet 408 must be strong enough to activate magneticdetector 414 when physiological sensor 110 is brought in the proximityof the magnetic detector 414. However, at the same time, the magnet 408must be positioned so that the magnet 408 does not falsely triggermagnetic detector 406 or any other magnetic detectors in other medicaldevices that may be implanted on a patient. For example, implantablecardio defibrillators may have embedded magnetic detectors that aretypically activated at a field strength of greater than 10 Gauss.However, in order to create a magnetic field that is reliably detectableby magnetic detector on a patient monitor 208, magnet 408 and magnet 416may need to provide a magnetic field or more than 10 Gauss.

Each magnet 408, 416 is located on the outside of their respectiveplastic housing 402, 410. Each magnet 408, 416 is recessed in theplastic housing 402 and positioned so that one side of each magnet 408,416 is flush with a side of the plastic housing 402. The reason magnets408 and 416 are located on the outside on their respective plastichousing 402, 410 is to permit the use of a weaker magnet than would beneeded if the magnets 408 and 416 were located within their plastichousing. The reason for this is the exponential decrease in magneticflux density with distance. Suppose a magnet were placed on the insideof the plastic and had sufficient magnetization to create a field of 10Gauss at 4 mm outside the plastic. Comparing to a magnet recessed asindicated by magnets 408 and 416 that has sufficient magnetization tocreate a field of 10 Gauss at 4 mm from the outside of the plastic, thelatter magnet would be weaker and its field strength at more than 4 mmfrom the outside of the plastic will be less than the field strength ofthe stronger magnet placed inside of the plastic.

Using a weaker magnet minimizes the risk of false triggers for medicaldevices that contain embedded magnetic detectors. Placing magnets 408and 416 on the outside of their respective plastic housings placesmagnet 408 closer to magnetic detector 414 than would be the case ifmagnet 408 were located inside of plastic housing 402 and places magnet416 closer to magnetic detector 406 than would be the case if magnet 416were located inside of plastic housing 410. Typically, the spacing gapbetween magnets 416 and magnetic detector 406 and between magnet 408 andmagnetic detector 414 is reduced by 2 millimeters by placing magnets 408and 416 on the outside of their respective plastic housings.

Physical detents may be included in the plastic housing to help the userproperly locate the sensor 110 relative to monitor 208 to trigger theproximity detection. Labels may be used over the magnets 408 and 416 andover the magnetic detectors 406 and 408 to help guide the user to placethe physiological sensor 110 in proper alignment with the magneticdetector in monitor 208.

FIGS. 5 and 6 show a flowchart 500 for a method for establishing aconnection between a sensor device, for example physiological sensor 110and a gateway device, for example patient monitor 208. At operation 502,a radio on the sensor device is in a non-connectable state. Typically,both the radio and the sensor device are powered off. An internal retrycount is set to zero.

At operation 504, a determination is made whether a proximity detectoron the sensor device is activated. The proximity detector on the sensordevice is typically not activated until the sensor device is proximal tothe gateway device. The determination of whether the proximity detectoris activated comprises whether a magnet, for example magnet 416 on thegateway device activates a magnetic detector, for example magneticdetector 406 on the sensor device. Depending on the strength of themagnet on the gateway device, the sensor device may need to be movedwithin centimeters of the gateway device or in some examples the sensordevice may need to physically touch the gateway device in order for themagnetic detector to be activated.

When a determination is made at operation 504 that the proximitydetector is not activated, control loops back to operation 502. Controlloops between operation 502 and operation 504 until the proximitydetector is activated.

When a determination is made at operation 504 that the proximitydetector is activated, at operation 506, the Bluetooth radio on thesensor device is set to a connectable state, in low-power. This includespowering on the radio if it was not powered. The use of low-power radiotransmission during connection improves security during the connectionprocess, but is not required.

At operation 508, a determination is made as to whether the sensordevice detects a second radio device, for example a Bluetooth radio, onthe gateway device and whether the gateway device detects a radio deviceon the sensor device. Typically, proximity detection occurs nearsimultaneously at sensor device and the gateway device and each placesits respective radio in a connectable state. This connectable state mayinclude also being discoverable. However, the Bluetooth radio on thegateway device may turn on at a slightly different time than theBluetooth radio on the sensor device. It is also possible that onemagnetic detector was triggered and the other was not.

If a determination is made at operation 508 that a second Bluetoothradio is not detected, typically because there is a slight delay inturning on power for the second Bluetooth radio, at operation 510 aretry count is incremented. At operation 512, a determination is made asto whether a retry limit has been reached. When it is determined atoperation 512, that a retry limit has not been reached, control returnsto operation 508 and another determination is made as to whether asecond Bluetooth radio has been detected. When it is determined atoperation 512, that a retry limit has been reached, control returns tooperation 502 and the sensor device is put back in a non-connectablestate. Alternatively, instead of a fixed number of retries, adetermination may be made at operation 512 as to whether a timeout limithas been reached.

When a determination is made at operation 508 that a second Bluetoothradio has been detected, at operation 516, Bluetooth pairing isperformed between the sensor device and the gateway device.

At operation 518, the radio devices are set to a standard power leveland the sensor device is paired to the gateway device. For example,standard power is 4 dBm for a Class II Bluetooth radio and 20 dBm for aClass I Bluetooth radio.

At operation 520, status and configuration information are transferredbetween the sensor device and the gateway device. The status andconfiguration includes such items as the strength of a battery on thesensor device and the model and version numbers of the sensor device andthe gateway device. The status and configuration information aretransferred in an attempt to determine whether the sensor device isoperationally compatible with the gateway device.

At operation 522, a determination is made as to whether the sensordevice and the gateway device are compatible. The determination is madeby comparing the model number and version of the sensor device with themodel number and version number of the gateway device to a file ordatabase indicating the set of compatible versions and models.

When it is determined at operation 522 that the sensor device and thegateway device are not compatible, at operation 524, a status messagethat the sensor device and gateway device are not compatible isdisplayed to the user. This status message might be displayed on thegateway device, the sensor device, a syslog server, through e-mail orother electronic communication. At operation 526, the logical connectionbetween the sensor device and the gateway device is broken and theconnection sequence ends. Breaking the logical connection might be atthe application layer or at the RF layer and might include removingstored pairing information. The incompatibility message may be sent to aserver.

When it is determined at operation 522 that the sensor device and thegateway device are compatible, at operation 528, a message that thesensor device and the gateway device are compatible is displayed on theuser interface of the gateway device and the clinician is prompted toconfirm the patient for the sensor device. The confirmation of thepatient to the sensor device provides an additional level of security toensure that the sensor device is being assigned to the correct patient.

If there is no confirmation determined at operation 528, at operation530, a determination is made as to whether the allotted wait time forthe clinician has expired. If a timeout occurs, meaning that theclinician has not confirmed the patient for the sensor device within areasonable period of time, at operation 524, a message is displayed onthe user interface of the gateway device that the patient has not beenconfirmed for the sensor and at operation 526, the logical connectionbetween the sensor device and the gateway device is broken. At operation530, if the timeout limit has not been reached, then control is returnedto operation 528.

When the patient has been confirmed for the sensor device, at operation532, the connection mode is selected. As discussed, the connection modecan be one of loose pairing, tight pairing or locked. Additionalconnection modes may be created to support additional clinical workflows.

A physiological sensor and monitor that incorporate Bluetooth technologyare computing devices and typically include at least one processingunit, system memory and a power source. Depending on the exactconfiguration and type of computing device, the system memory may bephysical memory, such as volatile memory (such as RAM), non-volatilememory (such as ROM, flash memory, etc.) or some combination of the two.System memory typically includes an embedded operating system suitablefor controlling the operation of the sensor device. The system memorymay also include one or more software applications, for exampleBluetooth, and may include program data.

The various embodiments described above are provided by way ofillustration only and should not be construed to limiting. Variousmodifications and changes that may be made to the embodiments describedabove without departing from the true spirit and scope of thedisclosure.

What is claimed is:
 1. A method for connecting a sensor device to apatient monitoring device, the method comprising: setting a first radioof the sensor device to off; detecting when the sensor device is inproximity of the patient monitoring device; upon detecting proximity ofthe patient monitoring device, turning on the first radio of the sensordevice; before pairing, detecting a second radio of the patientmonitoring device; after turning on the first radio of the sensor deviceand after detecting a second radio of the patient monitoring device,pairing the first radio of the sensor device to the second radio of thepatient monitoring device; transferring status information andconfiguration information to the patient monitoring device; determiningwhether the sensor device is compatible with the patient monitoringdevice; providing an indication if the sensor device is not compatiblewith the patient monitoring device; and selecting a connection modebetween the sensor device and the patient monitoring device, theconnection mode being one of: loose pairing that provides no alerts whena connection between the sensor device and the patient monitoring deviceis broken, and tight pairing that provides the alerts when theconnection between the sensor device and the patient monitoring deviceis broken.
 2. The method of claim 1, further comprising detecting theproximity of the patient monitoring device using at least one magnet. 3.The method of claim 2, further comprising turning on the first radio ina lower-power mode when the proximity is detected.
 4. The method ofclaim 1, further comprising turning on the first radio in a lower-powermode when the proximity is detected.
 5. The method of claim 1, furthercomprising setting the first radio in a standard power mode beforepairing the first radio of the sensor device to the second radio of thepatient monitoring device.
 6. The method of claim 1, wherein theconnection mode further includes locked pairing that provides the alertswhen an unapproved sensor is connected to the patient monitoring device.7. The method of claim 1, further comprising using the loose pairing toconduct a spot monitoring workflow.
 8. The method of claim 1, furthercomprising using the tight pairing to conduct a continuous monitoringworkflow.